netstat Command Examples in Linux

The netstat (network statistics) command is used to gather information about TCP connections to the system. Depending on the options used, netstat informs the user of existing connections, listening ports on the server, NIC information, etc.

Common options for the netstat command include:

The netstat command has been deprecated in favor of the ss command, but it may still be installed with some Linux distributions.

Syntax

The syntax of the netstat command is:

# netstat [options]

Output

The default output of netstat is in columnar format, as follows:

• The protocol used by the socket.
• The number of processes attached to the socket.
• Flags that give further information about the socket’s status.
• The type of socket access.
• The state of the socket.
• The ID of the process attached to the socket
• The path of the process attached to the socket.

An example is as follows:

unix 2 [ ] STREAM CONNECTED 472 /run/dbus/system_bus_socket

netsta Configuration files

netstat Command Examples

1. To display the kernel routing table:

# netstat -r
# netstat --route 

2. To display multicast group membership information

# netstat -g
# netstat --groups 

3. To display the kernel interface table:

# netstat -i
# netstat --interfaces
# netstat --interfaces=eth0 

4. To display a list of masqueraded connections:

# netstat -M
# netstat --masquerade 

5. To display summary statistics of each protocol:

# netstat -s
# netstat --statistics 

6. To set to verbose :

# netstat -v
# netstat --verbose 

7. To show numerical addresses instead of trying to determine symbolic host:

# netstat -n
# netstat --numeric 

8. To numerical host addresses but does not affect the resolution:

# netstat --numeric-hosts 

9. To numerical port numbers but does not affect the resolution:

# netstat --numeric-ports 

10. To show numerical user IDs but does not affect the resolution:

# netstat --numeric-users 

11. To print the selected information every second continuously:

# netstat -c 
# netstat --continuous

12. To display the additional information:

# netstat -e
# netstat --extend 

13. To include information related to networking timers:

# netstat -o
# netstat --timers 

14. To show the PID and name of the program to which each socket belongs:

# netstat -p
# netstat --program 

15. To show only listening sockets:

# netstat -l
# netstat --listening 

16. To show both listening and non-listening sockets:

# netstat -a
# netstat --all 

17. To print routing information from the FIB:

# netstat -F 

18. To print routing information from the route cach:

# netstat -C 

19. To print SELinux context:

# netstat -Z
# netstat --context 

20. To stop trimming long addresses:

# netstat -T
# netstat --notrim 

21. To set delay:

# netstat delay 2 

22. To get the help:

# netstat -h
# netstat --help 

23. To get the version:

# netstat --version 

netstat examples with multiple options combined

1. To see the currently active routing table:

# netstat -rnv

2. To see all the socket information:

# netstat -anp

3. To see all the listening ports:

# netstat -anp | grep LISTEN

4. To see all the process/services running and listening on ports:

# netstat -lnptu

5. To see the protocol specific statistics (e.g. for TCP):

# netstat -pt

6. To see the interface activity stats:

# netstat -i -t 2
# netstat -it 2

7. To see the summary stat for a particular port:

# netstat -st               (For TCP)
# netstat -su               (For UDP)